Privacy Policy (Draft)

AI Studio Prints processes the minimum data needed to design apparel, take orders, verify Shopify payments, and prepare fulfillment. We do not sell personal data.

What we process

• Guest session identifiers (hashed on the server)
• Account or recovery email when you request it
• Design prompts, uploads, and brand-kit settings you provide
• Order and proof metadata needed to quote, approve artwork, and fulfill
• Shopify Order fields (Level 1): payment status, amounts, currency, variants, quantities, and order correlation ids — for payment reconciliation, order administration, necessary security investigation, and fulfillment readiness only

What we do not do with Shopify Order data

We do not use protected Shopify Order payloads for marketing, advertising, resale, or unrelated analytics. We do not request Shopify Level 2 customer name, email, phone, or street address for payment reconciliation.

Retention and security

Temporary artifacts (magic links, expired download packages) expire on short schedules. Orders and customer-owned artwork are retained for accounting, disputes, and legal holds and are not purged by temporary cleanup jobs. Deployed traffic uses HTTPS. Secrets stay server-side. See the retention and encryption ops drafts for details.

Your rights

You may request access, correction, deletion, or opt-out of sale (we do not sell personal data) by contacting the owner or via POST /api/privacy/data-requests with type, email, and optional orderId / message. Requests are logged for manual fulfillment; we will not delete data required for legal or accounting holds.

Related drafts: Terms. Merchant app disclosure and DPA live under docs/legal/ (not auto-published).